Attackers Abuse AWS IAM’s Eventual Consistency to Maintain Stealthy Persistence

A critical exploitation technique that allows attackers to maintain access to AWS environments even after credentials are revoked.

The vulnerability stems from AWS Identity and Access Management’s eventual consistency model, which creates a three to four-second window where deleted access keys remain functional.

The Core Problem

When AWS IAM updates propagate across the distributed infrastructure, changes do not take effect immediately.

This architectural design choice creates a predictable security gap that sophisticated attackers can exploit.

During this propagation period, revoked credentials remain valid, allowing adversaries to establish new persistence mechanisms before losing access.

The attack scenario unfolds when security teams discover compromised AWS access keys and attempt to delete them.

Because of eventual consistency, the compromised credentials remain valid for approximately four seconds after deletion.

Attackers monitoring their access can detect the revocation attempt through the IAM ListAccessKeys API, which returns an empty array when keys are deleted.

Within the remaining time window, attackers can create new access keys or establish alternative persistence mechanisms before the system reaches complete consistency.

The persistence window extends beyond access key management to affect multiple IAM operations, including policy attachment and detachment, role assumption permissions, role creation and deletion, and login profile modifications.

This broader impact means that traditional incident response playbooks that rely on policy-based restrictions fail to contain compromised accounts properly.

OFFENSAI researchers found that attempting to restrict compromised users through IAM policies proves ineffective.

Attackers can detect newly attached deny policies within the consistency window and remove them before they take effect, rendering standard remediation procedures useless.

The most reliable defense involves AWS Organizations Service Control Policies, which operate at the account level and are beyond an attacker’s control.

Security teams should apply an SCP denying all actions for the compromised principal, wait the whole 4-second propagation period, then proceed with traditional cleanup procedures.

Alternatively, organizations can contact AWS directly to have compromised credentials quarantined.

AWS acknowledged the security implications after responsible disclosure and implemented partial fixes.

However, researchers confirmed that attackers can still detect IAM changes and create roles assumable by external accounts during the consistency window, indicating the issue remains partially unresolved despite AWS publishing official remediation guidance.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.